mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-07 00:48:01 +01:00
109 lines
8.3 KiB
Plaintext
109 lines
8.3 KiB
Plaintext
:_mod-docs-content-type: ASSEMBLY
|
|
[id="installing-fips"]
|
|
= Support for FIPS cryptography
|
|
include::_attributes/common-attributes.adoc[]
|
|
:context: installing-fips
|
|
|
|
toc::[]
|
|
|
|
You can install an {product-title} cluster in FIPS mode.
|
|
|
|
{product-title} is designed for FIPS. When running {op-system-base-full} or {op-system-first} booted in FIPS mode, {product-title} core components use the {op-system-base} cryptographic libraries that have been submitted to NIST for FIPS 140-2/140-3 Validation on only the x86_64, ppc64le, and s390x architectures.
|
|
|
|
For more information about the NIST validation program, see link:https://csrc.nist.gov/Projects/cryptographic-module-validation-program/validated-modules[Cryptographic Module Validation Program]. For the latest NIST status for the individual versions of {op-system-base} cryptographic libraries that have been submitted for validation, see link:https://access.redhat.com/articles/2918071#fips-140-2-and-fips-140-3-2[Compliance Activities and Government Standards].
|
|
|
|
[IMPORTANT]
|
|
====
|
|
To enable FIPS mode for your cluster, you must run the installation program from a {op-system-base} 8 computer that is configured to operate in FIPS mode. Running {op-system-base} 9 with FIPS mode enabled to install an {product-title} cluster is not possible.
|
|
|
|
For more information about configuring FIPS mode on {op-system-base}, see link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/assembly_installing-a-rhel-8-system-with-fips-mode-enabled_security-hardening[Installing the system in FIPS mode].
|
|
====
|
|
|
|
For the {op-system-first} machines in your cluster, this change is applied when the machines are deployed based on the status of an option in the `install-config.yaml` file, which governs the cluster options that a user can change during cluster deployment. With {op-system-base-full} machines, you must enable FIPS mode when you install the operating system on the machines that you plan to use as worker machines.
|
|
|
|
Because FIPS must be enabled before the operating system that your cluster uses boots for the first time, you cannot enable FIPS after you deploy a cluster.
|
|
|
|
[id="installation-about-fips-validation_{context}"]
|
|
== FIPS validation in {product-title}
|
|
|
|
{product-title} uses certain FIPS validated or Modules In Process modules within {op-system-base} and {op-system} for the operating system components that it uses. See link:https://access.redhat.com/articles/3655361[RHEL8 core crypto components]. For example, when users use SSH to connect to {product-title} clusters and containers, those connections are properly encrypted.
|
|
|
|
{product-title} components are written in Go and built with Red Hat's golang compiler. When you enable FIPS mode for your cluster, all {product-title} components that require cryptographic signing call {op-system-base} and {op-system} cryptographic libraries.
|
|
|
|
.FIPS mode attributes and limitations in {product-title} {product-version}
|
|
[cols="8a,8a",options="header"]
|
|
|===
|
|
|
|
|Attributes
|
|
|Limitations
|
|
|
|
|FIPS support in {op-system-base} 8 and {op-system} operating systems.
|
|
.3+|The FIPS implementation does not offer a single function that both computes hash functions and validates the keys that are based on that hash. This limitation will continue to be evaluated and improved in future {product-title} releases.
|
|
|
|
|FIPS support in CRI-O runtimes.
|
|
|FIPS support in {product-title} services.
|
|
|
|
|FIPS validated or Modules In Process cryptographic module and algorithms that are obtained from {op-system-base} 8 and {op-system} binaries and images.
|
|
|
|
|
|
|
|Use of FIPS compatible golang compiler.
|
|
|TLS FIPS support is not complete but is planned for future {product-title} releases.
|
|
|
|
|FIPS support across multiple architectures.
|
|
|FIPS is currently only supported on {product-title} deployments using `x86_64`, `ppc64le`, and `s390x` architectures.
|
|
|
|
|===
|
|
|
|
[id="installation-about-fips-components_{context}"]
|
|
== FIPS support in components that the cluster uses
|
|
|
|
Although the {product-title} cluster itself uses FIPS validated or Modules In Process modules, ensure that the systems that support your {product-title} cluster use FIPS validated or Modules In Process modules for cryptography.
|
|
|
|
[id="installation-about-fips-components-etcd_{context}"]
|
|
=== etcd
|
|
|
|
To ensure that the secrets that are stored in etcd use FIPS validated or Modules In Process encryption, boot the node in FIPS mode. After you install the cluster in FIPS mode, you can xref:../security/encrypting-etcd.adoc#encrypting-etcd[encrypt the etcd data] by using the FIPS-approved `aes cbc` cryptographic algorithm.
|
|
|
|
[id="installation-about-fips-components-storage_{context}"]
|
|
=== Storage
|
|
|
|
For local storage, use {op-system-base}-provided disk encryption or Container Native Storage that uses {op-system-base}-provided disk encryption. By storing all data in volumes that use {op-system-base}-provided disk encryption and enabling FIPS mode for your cluster, both data at rest and data in motion, or network data, are protected by FIPS validated or Modules In Process encryption.
|
|
You can configure your cluster to encrypt the root filesystem of each node, as described
|
|
in xref:../installing/install_config/installing-customizing.adoc#installing-customizing[Customizing nodes].
|
|
|
|
[id="installation-about-fips-components-runtimes_{context}"]
|
|
=== Runtimes
|
|
|
|
To ensure that containers know that they are running on a host that is using FIPS validated or Modules In Process cryptography modules, use CRI-O to manage your runtimes.
|
|
|
|
[id="installing-fips-mode_{context}"]
|
|
== Installing a cluster in FIPS mode
|
|
|
|
To install a cluster in FIPS mode, follow the instructions to install a customized cluster on your preferred infrastructure. Ensure that you set `fips: true` in the `install-config.yaml` file before you deploy your cluster.
|
|
|
|
[IMPORTANT]
|
|
====
|
|
To enable FIPS mode for your cluster, you must run the installation program from a {op-system-base} computer configured to operate in FIPS mode. For more information about configuring FIPS mode on RHEL, see link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/assembly_installing-the-system-in-fips-mode_security-hardening[Installing the system in FIPS mode].
|
|
====
|
|
|
|
* xref:../installing/installing_aws/installing-aws-customizations.adoc#installing-aws-customizations[Amazon Web Services]
|
|
* xref:../installing/installing_alibaba/installing-alibaba-customizations.adoc#installing-alibaba-customizations[Alibaba Cloud]
|
|
* xref:../installing/installing_azure/installing-azure-customizations.adoc#installing-azure-customizations[Microsoft Azure]
|
|
* xref:../installing/installing_bare_metal/installing-bare-metal.adoc#installing-bare-metal[Bare metal]
|
|
* xref:../installing/installing_gcp/installing-gcp-customizations.adoc#installing-gcp-customizations[Google Cloud Platform]
|
|
* xref:../installing/installing_ibm_cloud_public/installing-ibm-cloud-customizations.adoc#installing-ibm-cloud-customizations[{ibm-cloud-name}]
|
|
* xref:../installing/installing_ibm_power/installing-ibm-power.adoc#installing-ibm-power[{ibm-power-name}]
|
|
* xref:../installing/installing_ibm_z/installing-ibm-z.adoc#installing-ibm-z[{ibm-z-name} and {ibm-linuxone-name}]
|
|
* xref:../installing/installing_ibm_z/installing-ibm-z-kvm.adoc#installing-ibm-z-kvm[{ibm-z-name} and {ibm-linuxone-name} with {op-system-base} KVM]
|
|
* xref:../installing/installing_openstack/installing-openstack-installer-custom.adoc#installing-openstack-installer-custom[{rh-openstack-first}]
|
|
* xref:../installing/installing_vsphere/upi/installing-vsphere.adoc#installing-vsphere[VMware vSphere]
|
|
|
|
[NOTE]
|
|
====
|
|
If you are using Azure File storage, you cannot enable FIPS mode.
|
|
====
|
|
|
|
To apply `AES CBC` encryption to your etcd data store, follow the xref:../security/encrypting-etcd.adoc#encrypting-etcd[Encrypting etcd data] process after you install your cluster.
|
|
|
|
If you add {op-system-base} nodes to your cluster, ensure that you enable FIPS mode on the machines before their initial boot. See xref:../machine_management/adding-rhel-compute.adoc#adding-rhel-compute[Adding RHEL compute machines to an {product-title} cluster] and link:https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening#enabling-fips-mode-in-a-container_using-the-system-wide-cryptographic-policies[Enabling FIPS Mode] in the {op-system-base} 8 documentation.
|